Monthly control self-assessment
๐ก๏ธ Purpose
Monthly attestation cycle in which each control owner in the Control register: Distribution confirms their controls operated, with evidence, and records any failures.
Owner: Distribution Operations Manager ยท Cycle: calendar month, attestations due by working day 5
๐ Monthly attestation lifecycle
flowchart LR
A[Coordinator issues workbook] --> B[Control owners test controls]
B --> C[Ratings and evidence submitted]
C --> D{Any failures or exceptions?}
D -- Yes --> E[Root cause and remediation logged]
E --> F[Compliance escalation if regulatory impact]
D -- No --> G[Coordinator consolidates results]
F --> G
G --> H[Monthly ops review]๐ฅ Roles and responsibilities
- Issue attestation workbook on working day 1
- Validate completeness of submissions
- Consolidate monthly results
- Escalate overdue attestations
- Table outcomes at monthly ops review
๐ Procedure
On working day 1, the coordinator issues the attestation workbook listing each control, its owner and its evidence requirement.
Each control owner tests their control for the month:
- Sample-based for per-transaction controls (minimum 5 items or 10% of volume, whichever is greater)
- Report-based for continuous and detective controls
The owner records a rating: โ Effective, โ ๏ธ Effective with exceptions, or โ Failed, and attaches evidence.
For any rating other than Effective: record root cause, remediation action, action owner and target date. Root cause means the underlying reason, not a restatement of the failure.
The coordinator consolidates results by working day 5 and tables them at the monthly ops review (see Process Performance Reviews).
Failed controls with regulatory impact are escalated to Compliance within 24 hours of identification โ do not wait for the monthly cycle.
๐ Remediation lifecycle
Status | Definition | Owner Expectation | Escalation |
|---|---|---|---|
Open | Failure identified and remediation agreed | Action owner updates progress weekly | Coordinator monitors |
In progress | Remediation execution underway | Evidence retained for validation | Escalate if target date at risk |
Pending validation | Action implemented awaiting retest | Control owner provides supporting evidence | Coordinator validates closure readiness |
Closed | Remediation validated and effective | Evidence archived with attestation record | No further escalation required |
๐งพ Evidence expectations
- Evidence must be retained in a centrally accessible repository.
- Screenshots must include visible timestamps or report run dates.
- Sampling support must identify the tested population and selected sample.
- Evidence links should remain accessible for a minimum of 24 months.
โ ๏ธ Honesty rule
โ ๏ธ Governance expectation
Ratings are never negotiated. A failure honestly recorded and remediated is the process working as designed. Overdue remediation actions appear on the distribution scorecard until closed.